search

indix / kafkajs-lz4

🗜 LZ4 compression codec for KafkaJS
MIT License
15 stars 8 forks source link

Upgrade dependencies for vulnerabilities #17

Closed maulikpipaliya closed 1 year ago

maulikpipaliya commented 1 year ago

Vulnerability: Regular Expression Denial of Service (ReDoS)

Introduced through: kafkajs-lz4@2.0.0-beta.0 > lz4-asm@0.4.2 > yargs@3.32.0 > string-width@1.0.2 > strip-ansi@3.0.1 > ansi-regex@2.1.1

Vulnerable module : ansi-regex Introduced through kafkajs-lz4@2.0.0-beta.0 Fixed in ansi-regex@3.0.1, 4.1.1, 5.0.1, 6.0.1

Ref: https://security.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908

maulikpipaliya commented 1 year ago

Raised issue in lz4-asm

https://github.com/ukyo/lz4.js/issues/15